TL;DR: ShinyHunters, Lapsus$ and Scattered Spider appear to be re-emerging as a loose “Scattered LAPSUS$ Hunters” syndicate that markets extortion-as-a-service, a BreachForums successor and potential ransomware capability, with a small core group using Telegram, Tor and rented reputation to keep operating, according to Swarmnetics.
At a glance
What this is: Swarmnetics says prominent cybercrime brands are being repurposed as a cooperative syndicate that rents skills, markets extortion and uses Telegram and Tor to sustain operations.
Why it matters: This matters because criminal collaboration lowers the barrier to sophisticated attacks, which means identity, help desk and third-party access controls face faster, more adaptive abuse patterns.
Context
Cybercrime groups are no longer constrained to a single stable brand, structure or capability set. The article describes a shift toward loosely coordinated syndicates that rent expertise, reuse reputation and market specialised services, which makes attribution less useful than understanding the operational model behind the name.
For identity and access teams, the interesting part is not the gang label but the trust mechanics. A cooperative model can combine phishing, help desk abuse, extortion services and access brokering, which increases pressure on workforce identity, account recovery and privileged access workflows far beyond classic one-group threat modelling.
Key questions
Q: What breaks when cyber crime groups grow beyond a small core of members?
A: Once these groups move past a small team, they often need managers, contractors, and department-like functions to coordinate activity. That expansion can improve output, but it also increases the number of people with access to plans, systems, and profits. The result is a higher risk of leaks, factional splits, and operational instability when trust breaks down inside the organisation.
Q: Why does rented expertise increase the risk of identity abuse?
A: It lets attackers combine social engineering, access brokering and privilege abuse without keeping all skills inside one crew. That means workforce identity controls, help desk processes and privileged access safeguards can all be hit in the same campaign. Identity governance has to assume mixed tactics, not a single attack path.
Q: How can defenders tell when a criminal brand is really a recurring service model?
A: Look for repeated communication channels, mirrored messaging, overlapping infrastructure, and the same monetisation pattern appearing under different names. A brand that keeps reappearing after takedowns often signals a service layer built to survive bans. Detection should follow the operational pattern, not the logo.
Q: What should security teams prioritise if extortion crews can be hired on demand?
A: Prioritise the controls that interrupt handoff points: account recovery, help desk workflows, privileged elevation and third-party access. If an attacker can move from persuasion to access to extortion through separate specialists, every trust boundary becomes a control point. The goal is to make modular attack assembly too costly to scale.
Technical breakdown
How criminal syndicates scale capability through rented expertise
The article points to a market-like criminal model in which operators bring niche skills, reputation and distribution channels to short-lived collaborations. Instead of every group needing full end-to-end capability, a syndicate can assemble phishing, access brokering, extortion and ransomware components on demand. That makes the adversary ecosystem more resilient to arrests, bans and brand attrition because the function survives even when the name changes. For defenders, the key mechanism is capability reuse: the same access pathways, persuasion tactics and monetisation flows can appear across different aliases.
Practical implication: detect behaviours and infrastructure patterns, not just group names.
Why Telegram, Tor and reputation marketing matter to defenders
The article describes Telegram channels that reappear after bans and Tor sites that redirect followers, which shows how criminal groups use redundant communication layers to preserve customer trust. This is not just operational convenience. It is a reputational control plane for fraud and extortion, where continuity of contact signals legitimacy and supports repeat business. That makes takedowns incomplete if the underlying audience, contact graph and escrow-like trust relationships remain intact.
Practical implication: monitor re-emergent channels, impersonation patterns and trusted communication paths as part of threat intelligence.
What cooperative crime means for identity and access abuse
When criminals can hire specialists temporarily, identity controls face a wider range of attack styles without warning. A cooperative model can pair social engineering with help desk manipulation, consent phishing or privileged account abuse in ways that bypass narrowly scoped defences. The article also implies that access is now a service commodity, which aligns with recurring abuse of workforce identities, third-party access and delegated trust. That broadens the relevance of IAM, PAM and account recovery governance.
Practical implication: design identity controls for mixed tactics, including fraud, social engineering and privileged escalation.
Threat narrative
Attacker objective: The objective is to monetise criminal capability at scale by turning reputation, access and coercion into reusable services.
- Entry begins with reputation building, channel reuse and targeted outreach through Telegram and Tor to attract buyers or collaborators.
- Escalation occurs when operators use rented expertise, sockpuppet identities and service-style offerings to gain trust and operational leverage.
- Impact is achieved through extortion-as-a-service, access brokering or ransomware, with the syndicate model making disruption and attribution harder.
Breaches seen in the wild
- MGM Resorts breach 2023: A help desk call gave attackers Okta and Azure admin access at MGM, leading to ransomware, ten days of outages and a $100 million hit.
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cybercrime is becoming a services economy, not a team sport. The article describes a criminal model where expertise, reputation and infrastructure are rented across loosely linked actors instead of being owned by a single stable gang. That matters because disruption becomes harder when the function survives the brand. Defenders should track capability clusters, not just group names.
Identity abuse is now one of the easiest services to outsource. Once persuasion, access brokering and extortion can be rented, workforce identity and privileged access controls become exposed to a wider set of attack combinations. The governance challenge is no longer only stopping a single known adversary but constraining the reusable trust paths they all exploit. Teams should treat identity workflows as adversary marketplaces.
Extortion-as-a-service changes the risk model for help desks and access recovery. Cooperative crime makes it easier for attackers to mix social engineering with support-channel abuse and then hand off follow-on actions to specialists. That aligns directly with recurring weaknesses in help desk security and account recovery processes. Practitioners need to assume the first attacker is not necessarily the one who completes the intrusion.
Named concept: criminal capability fluidity. The article illustrates a system where offensive skill moves fluidly between actors, making disruption of one name far less effective than disruption of the shared trust, access and monetisation layer. This is an operational governance problem as much as a threat intelligence problem. Security teams should measure whether their controls still hold when the adversary is modular.
What this signals
Criminal capability fluidity: the adversary model is becoming modular, which means attribution and brand takedowns matter less than breaking the trust, access and monetisation layer that different actors can reuse. For practitioners, that shifts the emphasis toward detection of shared TTPs, not recognition of a familiar name.
The practical consequence is wider than threat intel. Help desks, access recovery flows and privileged access paths are now attractive because they can be composed with rented persuasion or extortion services. Teams that still treat those processes as support functions are underestimating how often they sit at the start of a criminal service chain.
For practitioners
- Strengthen help desk verification Require out-of-band verification and step-up checks for account recovery, password reset and MFA changes, especially for high-value workforce accounts and privileged users.
- Track adversary infrastructure reuse Correlate Telegram handles, Tor endpoints, domain patterns and impersonation behaviour so that bans or brand changes do not reset detection coverage.
- Harden privileged access pathways Limit standing privilege, require just-in-time elevation and isolate admin actions so a rented operator cannot easily pivot from social engineering to broad access.
- Review third-party access and delegated trust Inventory external support paths, reseller access, and partner integrations that could be abused as a service entry point for extortion or initial access.
Key takeaways
- Cybercrime syndicates are increasingly organised around reusable skills and trust mechanisms rather than fixed membership, which makes brand-based tracking less reliable.
- The operational evidence in the article points to Telegram, Tor and reputation marketing as persistence mechanisms that let criminal groups survive takedowns and rebrand quickly.
- Defenders need to focus on the control points that modular attackers repeatedly abuse, especially identity recovery, privileged access and third-party trust paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on modular attack chains that combine access, pivoting and service-style abuse. |
| Recommendation — Map modular criminal activity to credential access and lateral movement techniques in detection and hunting workflows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity and access controls are a prime target when attack services are rented and recombined. |
| Recommendation — Tighten access permissions and entitlement reviews around the workflows most exposed to social engineering and abuse. | ||
| CIS Controls v8 | CIS-5 — Account Management | Help desk abuse and account recovery are recurring entry points in cooperative cybercrime operations. |
| Recommendation — Harden account management processes so recovery and privilege changes cannot be converted into attack services. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Rented expertise often succeeds by turning authentication and reset processes into weak links. |
| Recommendation — Apply authenticator management controls to limit how recovery, reset and MFA changes can be abused. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | The article’s service economy mirrors misuse of delegated trust and operational credentials in attack chains. |
| Recommendation — Restrict human handling of machine credentials and delegated access so operators cannot repurpose them as criminal services. | ||
Key terms
- Criminal Capability Fluidity: A criminal operating model where specialist skills, infrastructure and reputation move between actors or temporary partnerships. Instead of one group owning the full attack chain, different participants provide access, persuasion, extortion or malware as separate services, making disruption harder and attribution less useful.
- Extortion-as-a-Service: Extortion-as-a-Service is a criminal model where coercion, leak-site management, negotiation, or ransomware operations are offered as reusable services. It turns extortion into a modular business process that can be consumed by multiple operators, widening the market for intrusion and increasing campaign volume.
- Reputational Infrastructure: The communication channels, branding cues and trust signals that make a criminal operation look stable to buyers, collaborators or victims. In cybercrime, this can include recurring handles, redirect sites and public messaging that preserve confidence even when the underlying membership changes.
- Helpdesk abuse: The manipulation of support processes to obtain resets, unlocks, factor re-enrolment, or other identity changes without rightful authorisation. It succeeds when operational convenience outweighs assurance and when support teams lack strong verification rules for high-risk requests.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners building stronger governance across identities, credentials, and access workflows.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org